From: Razvan Cojocaru <[email protected]> The function cannot fail since a4eeef17 ("Add function for common env setting of verify user/pass calls") moved the username check out of it, so it always returned KMDA_SUCCESS and man_def_auth could never become KMDA_ERROR. Make it void, track only whether deferred management auth is enabled, and drop the KMDA_* codes.
Change-Id: I04c128a934e9a2e767394dbe82427df2ee886178 Signed-off-by: Razvan Cojocaru <[email protected]> Acked-by: Frank Lichtenheld <[email protected]> Gerrit URL: https://gerrit.openvpn.net/c/openvpn/+/2118 --- This change was reviewed on Gerrit and approved by at least one developer. I request to merge it to master. Gerrit URL: https://gerrit.openvpn.net/c/openvpn/+/2118 This mail reflects revision 2 of this Change. Acked-by according to Gerrit (reflected above): Frank Lichtenheld <[email protected]> diff --git a/src/openvpn/ssl_verify.c b/src/openvpn/ssl_verify.c index 0cdec1e..f5af932 100644 --- a/src/openvpn/ssl_verify.c +++ b/src/openvpn/ssl_verify.c @@ -1521,18 +1521,9 @@ #ifdef ENABLE_MANAGEMENT -/* - * management deferred internal ssl_verify.c status codes - */ -#define KMDA_ERROR 0 -#define KMDA_SUCCESS 1 -#define KMDA_UNDEF 2 -#define KMDA_DEF 3 - -static int +static void verify_user_pass_management(struct tls_session *session, const struct user_pass *up) { - int retval = KMDA_ERROR; const struct key_state *ks = &session->key[KS_PRIMARY]; /* primary key */ /* set username/password in private env space */ @@ -1545,10 +1536,6 @@ } setenv_del(session->opt->es, "password"); - - retval = KMDA_SUCCESS; - - return retval; } #endif /* ifdef ENABLE_MANAGEMENT */ @@ -1613,12 +1600,7 @@ ASSERT(up && !up->protected); #ifdef ENABLE_MANAGEMENT - int man_def_auth = KMDA_UNDEF; - - if (management_enable_def_auth(management)) - { - man_def_auth = KMDA_DEF; - } + const bool man_def_auth = management_enable_def_auth(management); #endif /* enforce character class restrictions in username/password */ @@ -1706,9 +1688,9 @@ if (!skip_auth) { #ifdef ENABLE_MANAGEMENT - if (man_def_auth == KMDA_DEF) + if (man_def_auth) { - man_def_auth = verify_user_pass_management(session, up); + verify_user_pass_management(session, up); } #endif if (plugin_defined(session->opt->plugins, OPENVPN_PLUGIN_AUTH_USER_PASS_VERIFY)) @@ -1736,11 +1718,7 @@ bool script_ok = script_status == OPENVPN_PLUGIN_FUNC_SUCCESS || script_status == OPENVPN_PLUGIN_FUNC_DEFERRED; - if (script_ok && plugin_ok && tls_lock_username(multi, up->username) -#ifdef ENABLE_MANAGEMENT - && man_def_auth != KMDA_ERROR -#endif - ) + if (script_ok && plugin_ok && tls_lock_username(multi, up->username)) { ks->authenticated = KS_AUTH_TRUE; if (plugin_status == OPENVPN_PLUGIN_FUNC_DEFERRED @@ -1749,7 +1727,7 @@ ks->authenticated = KS_AUTH_DEFERRED; } #ifdef ENABLE_MANAGEMENT - if (man_def_auth != KMDA_UNDEF) + if (man_def_auth) { if (skip_auth) { _______________________________________________ Openvpn-devel mailing list [email protected] https://lists.sourceforge.net/lists/listinfo/openvpn-devel
